Malicious PDF — malware analysis report

Static analysis result for SHA-256 e51f6f2aabcd3de5…

MALICIOUS

PDF

13.4 KB Created: 2019-04-30 06:02:19 +01:00 Authoring application: mPDF 5.7
MD5: 7d4c0a4361f6a783b8643e639b42e484 SHA-1: c33ef8722379eac0ff47427b5abfbb2541969c15 SHA-256: e51f6f2aabcd3de5f2e3784287114b35ab3e087409b255ec2683aa2a64f88ea6
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified as a PDF_SEO_LINK_FARM heuristic. These links point to various book titles hosted on loaminoo.linkpc.net. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or as a distribution vector for further malicious content. No scripts were extracted, and the document body was unreadable.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8097098090092/Corsair-The-Oregon-Files-6-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/2099096095092099/Dark-Watch-The-Oregon-Files-3-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8097093099099/Sacred-Stone-The-Oregon-Files-2-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/2099096095093090/Skeleton-Coast-The-Oregon-Files-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090094099099092/Skeleton-Coast-The-Oregon-Files-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/6098098090/Typhoon-Fury-The-Oregon-Files-12-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8097099096097/Golden-Buddha-Sacred-Stone-The-Oregon-Files-1-2-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8097095098099/The-Navigator-NUMA-Files-7-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4093091091091098/White-Death-NUMA-Files-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4095090094099094/Ghost-Ship-NUMA-Files-12-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090090097098098/Polar-Shift-NUMA-Files-6-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4090095092091099/Piranha-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1093099096091099/Deep-Six-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090098090096090090/Incursi-n-nocturna-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/5090092090097092/The-Cutthroat-Isaac-Bell-10-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/3098091095098099/The-Bootlegger-Isaac-Bell-7-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4092098093094093/The-Tombs-Fargo-Adventure-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4098090095094/Dragon-Dirk-Pitt-10-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4093091091092093/Deep-Six-Dirk-Pitt-7-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8095099097094/Lost-Empire-Fargo-Adventure-2-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090090097098098/Polar

Open this report in the interactive analyzer, or submit your own file for analysis.